Village women stand in a queue to get themselves enrolled for Aadhaar, a controversial identification database in February 2013.
Mansi Thapliyal/Reuters

Blog Post

Blog posts represent the views of CFR fellows and staff and not those of CFR, which takes no institutional positions.

Chinmayi Arun is an assistant professor of law at National Law University in New Delhi and a fellow at the Berkman Klein Center at Harvard University. You can follow her @chinmayiarun

In a landmark decision, India’s Supreme Court acknowledged that Indians have a right to privacy. It will take years to properly understand the decision’s implications, although some are immediately clear. These changes may affect the government of India’s efforts at maintaining a centralized database of personal information, known as Aadhaar. They may also affect the operation of global platforms such as Facebook, Instagram, WhatsApp and Google in India.

Prior to the Supreme Court ruling, the right to privacy had been articulated in a patchwork, case-by-case manner.

This judgment takes a historic step by declaring that the Indian constitution contains the right to privacy, embedded in long-established fundamental rights including individual dignity, liberty and freedom of expression. The judges interpret the right to privacy broadly, to cover a range of activity from state intrusion (in the form of search and seizure, for example) to the collection and aggregation of personal data by private parties, such as employers or online platforms. Global web-based platforms may have some reason to worry about this. Private actors have been flagged as potential threats to the right to privacy, but the judgment simultaneously makes reference to the need to share users’ personal data with investigative agencies so that they can guard against cyberattacks and other threats to national security.

It calls many practices from the ubiquitous use of CCTV to unnecessarily intrusive questions in job and university applications into question. It also casts doubt on previous Indian Supreme Court decisions, like its infamous rejection of a plea to decriminalize homosexuality.

In its reasoning, the Court explicitly acknowledged the fast pace of technological development and that new ways to violate the right to privacy may emerge in the future, necessitating an expansive reading of the new right. As India moves towards digitization, algorithms and artificial intelligence, the judiciary will be able to interpret the right to privacy and apply it to new technological innovations.

Few rights are absolute, and the Court makes it clear that there are circumstances in which the state can restrict the right to privacy. The right to privacy may be curtailed through law in furtherance of legitimate state interests, if certain principles of proportionality are followed. The decision points to national security and the distribution of scarce resources in a social welfare state as examples where a vital state interest may justify the restriction of privacy. Future court cases will undoubtedly wrestle with setting the appropriate balance.

The other unexpectedly progressive feature of this judgment is that it has declared that the right to privacy is available against private parties. This means that global web-based platforms and other companies that process information in India will have to watch policy developments in India carefully, given that the Indian government is now required to ensure that they uphold citizens’ right to privacy. The government is already working towards a data protection statute, but the judgement may result in more concrete privacy safeguards that the data protection law may otherwise have offered.

The question currently on everybody’s mind is what the decision will mean for Aadhaar, India’s highly controversial state-run biometric identity database. For the moment, nobody knows. Aadhaar was originally designed as a voluntary measure to fight benefits fraud, but it is now mandatory for a range of basic tasks, such as opening bank accounts, attending school, and filing taxes. The Court was forced to consider whether a right to privacy existed in India as a result of a case challenging the legality of the database. The privacy ruling referenced Aadhaar but the final verdict on whether the database violates privacy in a manner permitted by the Indian constitution is left to the judges currently considering its legality.

It is still too early to tell how personal data collection and surveillance practices in India will change as a result of the landmark case. The devil may lie in the details. The world should watch India carefully to see whether the judiciary makes it easy to violate a right it just affirmed.